The Rules and Scoring Engine: The Heart of the System

The engine determines which behaviors are rewarded and how. It processes transactions, receipts, or events into points, status levels, or cashback, applying rules that are designed to be modified during operation—such as promotional periods, multipliers, product groups, and target audiences. The key question is whether such rules are configurable or whether they require development effort each time.

Other practical considerations include point expiration, cancellations, and adjustment entries: A program without a well-defined cancellation logic creates more work for support than the mechanism actually delivers in benefits. For more details, see : Loyalty Framework: Structure and Architecture, and Status Programs and Tiering.

Book a free consultation now →

Interfaces: CRM, ERP, online store, and point-of-sale system

A loyalty system is always an add-on system—it relies on data from systems that are already in operation. The key question isn’t whether integration is possible, but whether there are proven standard connections or whether every interface becomes a standalone project. Bidirectionality is what distinguishes a data silo from a controlled program.

Details by system: CRM and ERP integration (Salesforce, SAP, etc.), e-commerce integration for WooCommerce, Shopify, and Shopware, API-first: integration guide, and Headless Loyalty: API-only architecture.

Channels: App, Web Portal, and Mobile Wallet

Participants can access the program in three ways: through an app with a points account, a web portal for rewards and account balances, and the digital card in Apple Wallet or Google Wallet. Wallet is the channel with the lowest barrier to entry—no installation required, but it supports push notifications. The best combination depends on usage frequency and the target audience. For more information: Mobile Wallet and Digital Loyalty Card.

Data Layer: First-Party Data Instead of Data Silos

A loyalty program is the most effective legitimate way to obtain first-party data—provided that consent is properly obtained and the data remains under your control, not solely that of the service provider. Therefore, check early on who owns the data, what the export process looks like, and what happens if you switch providers. For more information: Using zero-party data in compliance with data protection regulations and GDPR-compliant loyalty programs.

Reporting, Analytics, and Automated Document Capture

Without reliable reporting, it is impossible to manage a program or verify whether it is effective. Key metrics such as participation rate, activation, redemption, and repurchase rate are useful—integrated with the company’s own BI or data warehouse system. In B2B, document processing is also a key consideration: invoices and receipts must be assigned to participants and sales.

In-Depth: Data Analytics in Loyalty Programs, Measuring Loyalty Success: Key KPIs, Predictive Analytics, and AI-Powered Invoice Capture.

Integration Matrix: Which Systems Are Connected

The following overview shows which system classes are typically connected and for what purposes:

System Class	Examples	The Purpose of the Connection
CRM	Salesforce, Microsoft Dynamics, HubSpot	Master Data, Segments, Campaign Management
ERP	SAP	Sales, Product and Customer Databases, Credit Memos
E-commerce	Shopware, Adobe Commerce, Shopify, WooCommerce	Orders, Points Credit, Redemption at Checkout
Trade/Retail	Oracle Retail, POS Systems	Receipt Entry, Offline Points, Card Identification
Wallet	Apple Wallet, Google Wallet	digital map, push notifications
BI / Data Warehouse	Existing DWH/BI landscape	Reporting, Cohorts, Impact Assessment
Custom	open REST API	In-House Developments and Custom Solutions

Hosting, Security, and Operating Model

The final layer is most often underestimated: Who actually runs the program on a day-to-day basis? A managed service with clear service commitments provides long-term relief for marketing and IT, while a pure licensing model generates internal overhead that is rarely factored into the budget. From a security perspective, the key considerations are the hosting location, certification, and data deletion policies.

At PRODATA, hosting takes place in Germany on TISAX-compliant Azure infrastructure; the company is ISO 27001-certified, and its programs are GDPR-compliant, scalable to up to 20 million participants, and support multiple languages and currencies. Further reading: Loyalty programs as a managed service, in-house development, or off-the-shelf software?

How to Make Architecture Decisions in a Structured Way

Don’t start with the software; start with three questions: Which systems absolutely must be integrated? How much of the operations do we want to handle ourselves? And how significantly will the program rules change over the next three years? The answers to these questions will almost inevitably determine whether a SaaS modular solution, a full-service platform, or a custom development is the right fit.

For selecting providers based on these criteria: Customer loyalty systems: software, providers, and selection criteria; loyalty software provider comparison; and RFPs and requests for proposals.

Replacing an Existing System: What Matters from a Technical Perspective

During a migration, the architecture is secondary—the data is what matters most. Point balances, status levels, consents, and historical transactions must be transferred completely and in a traceable manner; otherwise, participants will lose their balances and trust in the program. Therefore, before making a selection, clarify the format in which the legacy provider exports data, whether historical records are included, and how long parallel operation is possible.

A three-step approach has proven effective: a full test import with balance reconciliation, followed by a cut-off date import with the legacy system frozen, and finally, posting of transactions from the interim period. For more details: Switching Loyalty Systems: Migration Without Data or Customer Loss.

The Economic Significance of Architecture

Technology is rarely the biggest cost driver—that’s usually the premiums side of the business. However, the architectural decision affects all other areas: A system with a configurable rules engine saves on development effort over the years; proven standard integrations reduce project costs for every integration; and a managed service offloads operational expenses that would otherwise be incurred internally and are rarely budgeted for.

Therefore, don’t compare license prices; instead, compare total costs over three to five years—including internal expenses. For more information: “How Much Does a Loyalty System Cost? ” and ” Calculating the ROI of a Loyalty Program.”

Five Common Mistakes in Architectural Decisions

First: Check the feature list before defining the goals—you’re making comparisons before it’s even clear what behavior the program is supposed to change. Second: Treat integrations as an afterthought; they determine data quality and, therefore, every subsequent analysis. Third: failing to clarify data ownership in the contract—this will become costly at the latest when switching providers.

Fourth: Underestimating operating costs. A pilot program can be managed with existing resources, but an ongoing program—with support, campaigns, and incentive-related issues—cannot. Fifth: Incorporating legal and tax considerations too late—consent requirements, transparency obligations, and the treatment of in-kind rewards belong in the concept phase, not during the acceptance process. For more details: Tax Guide to Incentives and In-Kind Rewards.

Security, Data Protection, and Record-Keeping Requirements in Detail

Customer loyalty programs process a significant amount of personal data—contact information, purchase history, and, in some cases, location and device data. For IT and procurement, there are four points to review: the hosting location, the provider’s certification, the access control and data deletion policy, and whether a data processing agreement with clear subcontracting arrangements is in place.

It is important to clearly distinguish between two aspects that are often conflated in the market: the provider’s certification and the infrastructure’s compliance are not the same thing. PRODATA is certified to ISO 27001; hosting takes place in Germany on TISAX-compliant Azure infrastructure, and the programs are GDPR-compliant. For regulated industries such as banking, insurance, and pharmaceuticals, there are additional requirements regarding logging and approval processes.

Accessibility will become more relevant starting in 2025: Requirements under the BFSG or WCAG 2.1 AA can be implemented upon request and should be included early in the requirements specification because they affect user interfaces and communication channels. Further reading: GDPR-compliant loyalty programs and consent management in loyalty programs.

How the ProLoyalty platform maps out the six layers

ProLoyalty is the loyalty platform developed by PRODATA. It encompasses the rules and points engine, the app, web, and wallet channels, as well as the rewards store and reporting; integrations with CRM, ERP, and e-commerce systems are available as proven standard connections, supplemented by an open REST API for custom system environments. Operation is available as a managed service upon request.

The practical difference from a pure licensing solution lies less in the technology than in responsibility: design, platform, rewards logistics from our own warehouse, and day-to-day operations all come from a single source, rather than being coordinated across multiple service providers. Whether this model is right for you depends on how much internal management effort you’re willing to take on—you can weigh the pros and cons under “Full Service vs. Software-Only.”

When a Different Architecture Is the Right Choice

The full-service architecture described here isn’t the right choice in every case. A pure headless/API setup makes sense if you have your own development team that wants to build the user interfaces itself and only needs an engine along with an API.

A standard SaaS platform is sufficient if the program remains simple, does not require bonus logistics or document processing, and the rules rarely change. Conversely, things become more complex as soon as multi-tiered distribution, physical incentives, international rollouts, or regulatory requirements come into play—in such cases, an integrated architecture with end-to-end operations proves more beneficial.